GitHub Advisoryadvisory · npm

GHSA-p84x-5xx8-hff9 bson-objectid contains Improper input validation

HIGH Published 2022-05-24 Modified 2023-09-26 Official page ↗
Aliases
CVE-2019-19729
Ecosystem
npm
Packages
bson-objectid
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20, CWE-670
Reviewed
2023-07-18

Affected packages

• npm bson-objectid: <= 1.3.0 (no fix yet)

Description

An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it `detects _bsontype==ObjectID` in the user-input object. As a result, objects in arbitrary forms can bypass formatting if they have a valid bsontype.

Related

Alias · CVE (1)

  • CVE-2019-19729 An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-670 Always-Incorrect Control Flow Implementation weakness

References